#!/usr/bin/env bash
set -euo pipefail

# Generates a Traefik BasicAuth users string using Apache MD5 (apr1).
# Output format matches Traefik label: basicauth.users="user:hash"
#
# Usage:
#   ./generate-traefik-basicauth.sh <username> <password>
#
# Recommended to paste output into:
#   /etc/runtipi/app-data/runtipi/rego-tunnel/app.env
# as:
#   NOVNC_BASIC_AUTH_USERS='<output>'

user="${1:-}"
pass="${2:-}"

if [[ -z "$user" || -z "$pass" ]]; then
  echo "Usage: $0 <username> <password>" >&2
  exit 2
fi

if ! command -v openssl >/dev/null 2>&1; then
  echo "openssl not found; cannot generate apr1 hash" >&2
  exit 1
fi

hash="$(openssl passwd -apr1 "$pass")"
printf "%s:%s\n" "$user" "$hash"